[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","rapid-alert","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png","LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.","Marcus Lenngren","2026-10-23T12:58:00.867+00:00","![LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOn 21 October 2026, attackers published a malicious LiteLLM version 1.107.0 to PyPI and to Docker Hub and GHCR. LiteLLM is a widely used proxy and SDK for routing requests across LLM providers, with about 92 million monthly PyPI downloads and users including NVIDIA, Netflix, AT&T and Okta.\n\nThe attackers did not touch the application code. They placed three files, cook.pth, cook.py and sitecustomize.py, into the Python library directory. When Python starts, it processes executable .pth lines and then imports sitecustomize, so the payload runs before any application imports LiteLLM. The payload is a credential stealer plus a remote access tool. Running Python or pip to inspect or repair an affected install also triggers it.\n\nThe stealer harvests cloud credentials (AWS, GCP, Azure, Kubernetes, Docker), AI tool keys (Anthropic, OpenAI, GitHub Copilot and more), LiteLLM's stored provider keys, Git, GitHub, npm, PyPI and CI\u002FCD credentials, .env files, SSH, GPG and TLS keys, browser logins and cookies, environment variables and shell history. Stolen data is encrypted with AES-256-CBC under an RSA-4096 key and sent to litellm[.]dev\u002Fhealthcheck. The sitecustomize.py loader checks a GitHub-hosted pointer every hour and runs whatever Python the attacker serves.\n\nPer LiteLLM's post-mortem, the attackers obtained GitHub CLI OAuth tokens for an innocuously named account in its internal, internet-exposed deployment. The tokens were likely leaked into LiteLLM logs by Claude Code. The attackers disabled branch protections, merged a change pointing the releaser to a lookalike repository (Berri-AI\u002Flitellm, one hyphen off the real BerriAI\u002Flitellm), then signed and published the poisoned artifacts.\n\n## Timeline\n\n- 09:48 UTC: commit adds the payload data directory to the build config.\n- 10:51 to 11:06 UTC: malicious container build runs.\n- 11:39:51 UTC: all seven wheels live on PyPI.\n- 11:46 UTC: multiple scanners flag the malware, within minutes of publish.\n- ~13:14 UTC: GHCR floating tags found resolving to the malicious image.\n- 13:23 UTC: PyPI wheels removed.\n- 13:51 UTC: GHCR images made unavailable.\n- 14:20 UTC: Docker Hub tags repointed to clean artifacts.\n\n## Am I affected?\n\nYou are affected if, during the window on 21 October, you:\n\n- Installed litellm 1.107.0 from PyPI (any of the seven wheels, on Windows, Linux or macOS).\n- Pulled ghcr.io\u002Fberriai\u002Flitellm, litellm-database or litellm-non_root, or litellm\u002Flitellm on Docker Hub, by the tags v1.107.0, latest, main-latest or main-stable. Floating tags could have pulled the bad image without you selecting 1.107.0.\n\nLiteLLM says enterprise customers pulling from its private repository were not affected.\n\n## What to do now\n\n1. Stop and isolate any deployment, proxy container or CI runner that ran 1.107.0. Do not start Python or pip in those environments to \"check\" them.\n2. Treat the host as compromised. Isolate it and rebuild from clean backups. Removing the LiteLLM package directory alone can leave the startup files or an active loader behind.\n3. Rotate every secret that touched the environment: AWS, GCP and Azure credentials, Kubernetes and Docker secrets, AI provider keys, Git and GitHub tokens, npm and PyPI tokens, CI\u002FCD credentials, SSH, GPG and TLS keys, and database connection strings.\n4. Pin and redeploy from a known clean version: 1.106.2, the latest release before the attack.\n5. Pin Docker images by digest, not floating tags, after confirming the digest is clean.\n\n## How to hunt\n\n- Search filesystems and images for cook.pth, cook.py and sitecustomize.py in the Python library directory. Inspect images and wheels as data, without executing them.\n- Check outbound connections and logs for litellm[.]dev, in particular requests to \u002Fhealthcheck.\n- Review any Python process that set the environment variable PRIVCOLLECT_ACTIVE=1.\n- For cloud accounts, review logs for unexpected activity. Wiz observed attackers using stolen AWS credentials to query Amazon Bedrock models (LLMjacking) about 4.5 hours after exfiltration.\n- Check for the compromised image index sha256:1bbcb1443bc9… and the related database and non_root digests.\n\n## What does not help\n\n- Deleting the litellm package directory on its own. The .pth and sitecustomize startup hooks or the hourly loader can persist.\n- Reviewing the release tag's pyproject.toml. The malicious data setting was not present in the tag, so a tag-only review would miss it.\n- Starting Python or pip to inspect the install. That re-runs the payload.\n\n## Sources\n\n- [LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials](https:\u002F\u002Fsocket.dev\u002Fblog\u002Flitellm-compromise?utm_medium=feed), SocketDev, 21 Oct\n- [LiteLLM Compromised in Fresh Supply Chain Attack](https:\u002F\u002Fwww.securityweek.com\u002Flitellm-compromised-in-fresh-supply-chain-attack\u002F), SecurityWeek, 23 Oct\n- [LiteLLM release pipeline hacked to distribute info-stealer malware](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flitellm-release-pipeline-hacked-to-distribute-info-stealer-malware\u002F), BleepingComputer, 22 Oct\n- [LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-compromised-in-supply-chain.html), The Hacker News, 21 Oct\n- [LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-suspects-github-token-leak-in.html), The Hacker News, 22 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,45],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",{"slug":37,"kind":38,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":44},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":46,"kind":6,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":18},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00"]